diff options
| author | Eric Dumazet <edumazet@google.com> | 2026-01-28 17:15:38 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-02-11 15:41:54 +0300 |
| commit | 9b186feb752674f98abc77520a8d63f7063779c6 (patch) | |
| tree | 02c106e696ddee883ede645b7fb5160389e31fa4 /include/linux | |
| parent | f8611a7981cd0b42c7ce4b0ab93e3b9c646a01ec (diff) | |
| download | linux-9b186feb752674f98abc77520a8d63f7063779c6.tar.xz | |
net: add skb_header_pointer_careful() helper
[ Upstream commit 13e00fdc9236bd4d0bff4109d2983171fbcb74c4 ]
This variant of skb_header_pointer() should be used in contexts
where @offset argument is user-controlled and could be negative.
Negative offsets are supported, as long as the zone starts
between skb->head and skb->data.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260128141539.3404400-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: cabd1a976375 ("net/sched: cls_u32: use skb_header_pointer_careful()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/skbuff.h | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index a7cc3d1f4fd1..50f127451dc6 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -4301,6 +4301,18 @@ skb_header_pointer(const struct sk_buff *skb, int offset, int len, void *buffer) skb_headlen(skb), buffer); } +/* Variant of skb_header_pointer() where @offset is user-controlled + * and potentially negative. + */ +static inline void * __must_check +skb_header_pointer_careful(const struct sk_buff *skb, int offset, + int len, void *buffer) +{ + if (unlikely(offset < 0 && -offset > skb_headroom(skb))) + return NULL; + return skb_header_pointer(skb, offset, len, buffer); +} + static inline void * __must_check skb_pointer_if_linear(const struct sk_buff *skb, int offset, int len) { |